Collected research

Introducing lightyear: a new way to dump PHP files

Introducing lightyear, a new way to dump PHP files

Speeds up dumping files through a blind PHP file-read primitive: iconv charset conversions remap the base64 alphabet so a chosen digit becomes a newline, and PHP's lenient dechunk filter then strips everything before it. An attacker can pull tens of thousands of bytes with small payloads, six requests per digit, without raising PHP warnings.

Record

Document

Introducing lightyear, a new way to dump PHP files

Published by

blog.lexfo.fr

Topic

Server

In the archive

• Collected in the 2024 research round

Related sources

• lightyear
• the blogpost

Tags

• lfi
• php
• charset
• side-channel
• info-leak
• encoding
• tooling
• prior-art-extension
• owasp-a01-2021
• owasp-a02-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of blog.lexfo.fr, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.